feat(core): update tokenless workflows and supporting modules

.changeset/README.md

@@ -4,4 +4,4 @@ Add one changeset for every user-visible change to the published `tokenless` CLI
 
 Run `npm run changeset` and select `tokenless`. The release workflow creates a
 version pull request only when an unpublished changeset is present. Merging that
-pull request publishes all six native runtime packages before the universal CLI.
+pull request publishes the single pure JavaScript `tokenless` package.

.changeset/bright-profiles-wave.md

@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Add case-sensitive `-P` profile and `-p` provider CLI shortcuts.

.changeset/browser-connection-mode-evaluation.md

@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Add an experimental config-only Playwright/CDP browser connection mode and a two-mode real-browser capability matrix while preserving the existing default.

.changeset/browser-runtime-selection.md

@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add profile-bound browser runtime selection with system-first auto discovery, a locked managed Chrome for Testing fallback, explicit Anti-Detect CloakBrowser setup, safe known-Chromium profile/version inventory before Cloak download, exact four-component Cloak compatibility classification, interactive or explicit non-interactive clean-profile confirmation, clean runtime-isolated profiles, exact daemon runtime errors, transactional artifact security verification, per-provider setup review tabs, keychain-neutral E2E Cloak launches, separate doctor profile/runtime compatibility checks, and gated real-browser acceptance coverage.

.changeset/calm-dolphins-help.md

@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Reorganize CLI help into concise canonical and advanced command groups.

.changeset/calm-workspaces-align.md

@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add experimental four-provider capability inspection, explicit Workspace fallback modes, trusted conversation continuation, and visible file-upload acceptance evidence.

.changeset/capability-first-routing.md

@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add a canonical task-capability catalog, expose evidence-backed provider routes through `tokenless capabilities list`, and route normal runs by explicit and inferred capability requirements before browser mutation.

.changeset/capability-ranked-provider-fallback.md

@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Rank automatic provider fallback by the run's complete capability requirements, recheck live eligibility before mutation, reject under-declared routes, preserve a versioned context envelope, expose structured durable fallback evidence, and fail closed when file selection lacks visible provider acceptance.

.changeset/claude-cloudflare-known-issue.md

@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Classify Claude Cloudflare human checks as a narrow live E2E release-gate known issue when the durable blocker code is structured as `visible_cloudflare_turnstile` or `visible_cloudflare_interstitial`.

.changeset/clean-daemon-v1-boundary.md

@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Unify and simplify the local CLI-daemon HTTP boundary under one Tokenless Daemon API v1 OpenAPI contract: keep only public job and browser-runtime routes, run Playwright coordination in-process, require proof before bearer use, and remove unreleased legacy payloads and extension compatibility.

.changeset/clean-provider-registry.md

@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add experimental Qwen guest-session support through the shared provider registry and visible Playwright workflow.

.changeset/clear-command-map.md

@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Publish a complete bilingual CLI command reference and link it from built-in help and public READMEs.

.changeset/deepseek-provider.md

@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add the experimental DeepSeek visible-session provider with safe navigation, sign-in detection, baseline chat controls, and evidence-gated capability classification.

.changeset/deepseek-visible-controls.md

@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add experimental DeepSeek visible provider support with exact Instant, Expert, and Vision mode selection, independent DeepThink and Search controls, hCaptcha detection, mode-aware capability inspection, and provenance-bound real-session DOM fixtures.

.changeset/doubao-experimental-provider.md

@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add an experimental signed-in Doubao adapter with visible account and free-tier inspection, Cloak-tested file upload, exact mode and coding-oriented Web skill controls, visible unavailable-state handling, prompt and response handling, and provider challenge detection.

.changeset/durable-agent-replay.md

@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Start the local daemon on demand with SQLite-backed dynamic endpoint discovery, recover leased and checkpointed jobs after restart, and add agent-scoped one-time outcome replay with durable full-result lookup.

.changeset/gentle-composers-verify.md

@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Accept non-empty visible composer content after prompt input instead of requiring an exact DOM text match.

.changeset/grok-visible-entitlements.md

@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Report Grok profiles as Free or SuperGrok from visible model entitlements and inventory redacted provider DOM fixtures by page URL.

.changeset/guest-access-routing.md

@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Add provider access/tier reporting and a provider-session state machine that runs ChatGPT and Gemini guest sessions, hands unauthenticated Claude and Grok jobs to the user before task input, and persists redacted structural DOM snapshots.

.changeset/import-profile-compatibility-state.md

@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Preserve limited Chromium compatibility state when importing a browser profile with explicit user consent.

.changeset/keychain-neutral-production-browser.md

@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Keep every production Chromium launch keychain-neutral with `--password-store=basic` and `--use-mock-keychain`, regardless of the configured browser executable or connection mode.

.changeset/local-web-control-plane.md

@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add the secure bilingual local web control plane, profile-scoped provider and browser preferences, reserved dashboard tabs, setup handoff, dashboard CLI command, and browser-facing administration API.

.changeset/localized-cli-language.md

@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add English and Simplified Chinese CLI output selected during setup or through the persistent language config.

.changeset/manual-profile-onboarding.md

@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Keep managed-profile initialization user-run instead of triggering it from agent skills.

.changeset/perplexity-experimental-provider.md

@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add experimental Perplexity guest chat routing with live prompt submission, completed responses, normalized citations, and visible citation-link closure through a managed Cloak profile.

.changeset/profile-owned-browser-instances.md

@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Keep one stable browser instance per active managed profile while removing the macOS-specific inspection launcher.

.changeset/prompt-controls-wait.md

@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Wait for visible prompt input and submit controls, distinguish availability timeouts from action failures, and allow free or anonymous prompt surfaces without an authentication precheck.

.changeset/provider-availability-routing.md

@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Route implicit provider jobs through cached setup observations, report pre-submission errors when no cached provider is usable, and make doctor report provider usability plus normally stopped on-demand runtime state without treating either as damage.

.changeset/provider-rate-limit-cadence.md

@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add a packaged subscription-aware provider rate-limit catalog, durable submission history, cadence-based admission and deferral, in-scope provider fallback, visible cooldown handling, and `tokenless limits inspect` diagnostics.

.changeset/provider-runtime-fallback.md

@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Automatically fallback implicit runs across capability-compatible providers before human handoff while preserving one durable job and provider-attempt history.

.changeset/provider-whitelist-config.md

@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Rename persistent preferred provider configuration to `providerWhitelist`, default it to every non-disabled provider except Gemini, and migrate existing config on the next write.

.changeset/providerless-profile-open.md

@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Allow `tokenless profiles open` to launch a managed profile without selecting or navigating to a provider unless `--provider` is passed.

.changeset/pure-js-runtime.md

@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Ship Tokenless as a pure JavaScript package with the TypeScript daemon embedded in the CLI package, removing platform-specific native runtime packages and standalone Playwright runner artifacts.

.changeset/quiet-tabs-preserve.md

@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Preserve independent browser tabs for different providers, projects, and conversations unless a local job explicitly requests replacement.

.changeset/qwen-dns-throttling.md

@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Record intermittent Qwen DNS failures as retryable suspected rate limits without claiming confirmed provider throttling, and document the distinction and recovery steps.

.changeset/qwen-visible-modes.md

@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add Qwen-specific mode discovery and selection, including Deep Research variants and Auto/Thinking/Fast effort controls.

.changeset/real-native-projects.md

@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add real Claude and Grok native Project creation, exact reuse, instruction outcomes, and durable Project-scoped conversation identity. Use the canonical Qwen Studio chat surface with hydration-safe guest submission.

.changeset/setup-daemon-exact-reconcile.md

@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Make ordinary daemon reuse depend on verified ready identity plus the exact package version, and let `tokenless setup` reconcile same-home version drift only after proof verification.

.changeset/setup-handoff-headed.md

@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Check each provider's setup sign-in status once and report it without opening a login handoff or retrying.

.changeset/setup-runtime-preflight.md

@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Make `tokenless setup` report the local CLI version against npm latest and reconcile installed-runtime drift after verified same-home ready identity.

.changeset/signed-capability-readiness.md

@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Simplify daemon readiness to the same-home proof plus exact package version, and keep shutdown on the bearer-authenticated control endpoint.

.changeset/soft-lamps-daemon-stop.md

@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Negotiate daemon reuse independently from package versions, and add `tokenless daemon stop` with same-home ready verification followed by bearer-authenticated graceful self-shutdown that waits for the daemon-managed browser to release its profile before returning.

.changeset/strict-cli-options.md

@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Reject unknown and command-incompatible CLI options before dispatch, include command usage in human and JSON errors, and add common per-command `-h`/`--help`.

.changeset/unified-global-maintenance.md

@@ -0,0 +1,5 @@
+---
+"tokenless": patch
+---
+
+Unify setup and upgrade maintenance so the verified current CLI always upserts global Tokenless skills and reconciles its matching TypeScript daemon.

.changeset/visible-provider-accounts.md

@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Fail provider authentication checks closed on visible account controls and include visible provider usernames and subscription labels in managed profile output.

.changeset/zai-experimental-provider.md

@@ -0,0 +1,5 @@
+---
+"tokenless": minor
+---
+
+Add experimental Z.ai guest chat routing with Cloak-verified prompt submission, completed visible responses, conversation mapping, and durable state.

.github/pull_request_template.md

@@ -0,0 +1,2 @@
+- [ ] I ran the applicable manual real-provider E2E gates locally, or this pull request does not affect visible-provider behavior.
+- [ ] Every applicable real-provider E2E passes before release; invoked suites had no skipped case or internal retry.

.github/workflows/publish-npm.yml

@@ -30,32 +30,10 @@ jobs:
       - id: release
         run: node scripts/release/verify-pending.mjs "$GITHUB_OUTPUT"
 
-  publish-native:
+  publish-cli:
     needs: prepare
     if: needs.prepare.outputs.publish == 'true'
-    runs-on: ${{ matrix.runner }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: macos-14
-            platform: darwin
-            arch: arm64
-          - runner: macos-15-intel
-            platform: darwin
-            arch: x64
-          - runner: ubuntu-24.04-arm
-            platform: linux
-            arch: arm64
-          - runner: ubuntu-24.04
-            platform: linux
-            arch: x64
-          - runner: windows-11-arm
-            platform: win32
-            arch: arm64
-          - runner: windows-2022
-            platform: win32
-            arch: x64
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -64,36 +42,41 @@ jobs:
           cache: npm
       - name: Install npm with Trusted Publishing support
         run: npm install --global npm@11.15.0
-      - name: Install Rust
-        run: rustup toolchain install stable --profile minimal
-      - name: Build and verify this native runtime
-        run: npm --prefix packages/cli run build:native
-      - name: Publish native runtime
-        run: node scripts/release/publish-package.mjs "packages/cli/npm/tokenless-native-${{ matrix.platform }}-${{ matrix.arch }}"
+      - name: Install dependencies
+        run: npm ci --ignore-scripts
+      - name: Publish CLI
+        run: node scripts/release/publish-package.mjs packages/cli
 
-  publish-cli:
-    needs: [prepare, publish-native]
+  create-github-release:
+    needs: [prepare, publish-cli]
     if: needs.prepare.outputs.publish == 'true'
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version: '24'
-          cache: npm
-      - name: Install npm with Trusted Publishing support
-        run: npm install --global npm@11.15.0
-      - name: Install dependencies
+      - name: Extract release notes from persisted changelog
+        env:
+          VERSION: ${{ needs.prepare.outputs.version }}
+        run: node scripts/release/extract-changelog-section.mjs "$VERSION" /tmp/tokenless-release-notes.md
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ needs.prepare.outputs.version }}
         run: |
-          # Native packages are published immediately before this job, so refresh
-          # their optional-dependency entries while installing the workspace.
-          rm package-lock.json
-          npm install --ignore-scripts
-      - name: Publish universal CLI after every native runtime
-        run: node scripts/release/publish-package.mjs packages/cli
+          TAG="v$VERSION"
+          if gh release view "$TAG" >/dev/null 2>&1; then
+            echo "Release $TAG already exists; leaving it unchanged."
+          else
+            gh release create "$TAG" \
+              --target "$GITHUB_SHA" \
+              --title "tokenless $TAG" \
+              --notes-file /tmp/tokenless-release-notes.md
+          fi
 
   clear-pending-marker:
-    needs: [prepare, publish-cli]
+    needs: [prepare, create-github-release]
     if: needs.prepare.outputs.publish == 'true'
     runs-on: ubuntu-24.04
     steps:
@@ -115,7 +98,6 @@ jobs:
           git checkout -B "$CLEANUP_BRANCH" origin/main
           node scripts/release/verify-pending.mjs /tmp/release-output
           grep -Fx "version=$VERSION" /tmp/release-output
-          rm package-lock.json
           npm install --package-lock-only --ignore-scripts
           git rm .changeset/publish-pending.json
           git add package-lock.json